Application Security Analyst — Secure SDLC & Cloud (Hybrid)

Rest; Sydney, City of Melbourne; Hybrid; AUD 120,000 - 170,000; Full time

Benefits offered by this job

5 Rest Days (wellbeing days)

Paid parental leave (22 weeks)

Learning and development opportunities

Income Protection Insurance

Additional leave options

Job summary

Rest is seeking an Application Security Analyst on an 18 Month Fixed Term Contract to strengthen security of applications, APIs and software delivery. You will work closely with engineering and product teams to embed secure practices and lead secure development efforts.

Responsibilities include running security assessments, threat modelling, and driving tooling and secure delivery across cloud-native environments, with a focus on delivering measurable risk reductions for millions of Australians.

Qualifications

• Experience in application security, DevSecOps or secure software development within a complex enterprise environment.
• Experience conducting application security assessments across web applications, APIs and cloud-native environments.
• Strong knowledge of OWASP Top 10, secure coding principles, threat modelling and vulnerability management.
• Hands-on experience with SAST, DAST, SCA, API security testing and secrets detection.
• Familiarity with security frameworks and standards such as OWASP ASVS, OWASP SAMM, NIST CSF and APRA CPS 234.
• Understanding of CI/CD pipelines and cloud platforms, ideally AWS.
• Good communication skills to translate findings into actionable recommendations.

Responsibilities

• Lead application security assessments across web applications, APIs and cloud-based services, identifying risks and remediation plans.
• Partner with engineering and architecture teams to embed security into solution design via threat modelling.
• Validate and manage findings, prioritise remediation, and distinguish genuine risks from false positives.
• Drive tooling and process improvements for SAST, DAST, SCA, API security testing and secrets detection.
• Promote secure SDLC and DevSecOps practices, integrating controls into CI/CD pipelines.
• Coordinate penetration testing activities and oversight remediation outcomes.
• Develop and maintain application security standards, guardrails and secure development practices.
• Provide security guidance and enablement to developers and security champions.

Skills

Application Security

DevSecOps

Threat Modelling

SAST

DAST

SCA

API Security

Secure SDLC

CI/CD

Cloud Security

Education

Bachelor's degree in Computer Science

Tools

OWASP ASVS

OWASP SAMM

NIST CSF

APRA CPS 234

Job description

Rest is seeking an Application Security Analyst on an 18 Month Fixed Term Contract to strengthen security of applications, APIs and software delivery. You will work closely with engineering and product teams to embed secure practices and lead secure development efforts.

Responsibilities include running security assessments, threat modelling, and driving tooling and secure delivery across cloud-native environments, with a focus on delivering measurable risk reductions for millions of Australians.